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The synchronization process of two mutually delayed coupled deterministic chaotic maps is demon- 
strated both analytically and numerically. The synchronization is preserved when the mutually 
transmitted signal is concealed by two commutative private filters that are placed on each end of 
the communication channel. We demonstrate that when the transmitted signal is a convolution 
of the truncated time delayed output signals or some powers of the delayed output signals syn- 
chronization is still maintained. The task of a passive attacker is mapped onto Hilbert's tenth 
problem, solving a set of nonlinear Diophantine equations, which was proven to be in the class of 
NP-Complete problems. This bridge between two different disciplines, synchronization in nonlinear 
dynamical processes and the realm of the NPC problems, opens a horizon for a new type of secure 
public-channel protocols. 



Chaotic systems are very unpredictable and two 
chaotic systems, starting from almost identical initial 
states, end in completely uncorrelated trajectories [lj. 
Nevertheless, two chaotic systems which are cou- 
pled by some of their internal variables may syn- 
chronize to a common identical chaotic motion 0, HI- 
Unpredictability^ or chaos synchronization, of coupled 
chaotic systems, have attracted a lot of attention, mainly 
because of the potential to build a secure communication 
protocol based on artificial chaotic systems [H, [1] or cou- 
pled chaotic lasers @, 

The security of a public-key encryption protocol based 
on chaos synchronization relics on the fact that two 
chaotic systems, A and B, synchronize by bi-directional 
interaction whereas a third unit E, which is only driven 
by the transmitted signal cannot synchronize. However, 
it is not obvious that this is possible at all. On one 
hand, the two mutually coupled chaotic systems influence 
the dynamics of each other and can accelerate the syn- 
chronization by enhancing coherent moves, whereas the 
unidirectionally coupled system, an attacker, cannot in- 
fluence the synchronization process. On the other hand, 
the attacker is allowed to record and to manipulate his 
recorded signals, without affecting the synchronization 
process 0, [lO]. Note that the two partners, A and B, are 
not allowed to exchange any secret information; the at- 
tacker E knows all the details which A knows about the 
system of B and vice versa. 

For identical partners which synchronize by a bi- 
directional signal we recently presented a proof that an 
attacking unit coupled unidirectionally can synchronize 
as well 11]. The proof is valid for any type of transmit- 
ted signals, for instance, a nonlinear function of the time 
delayed output signals. For non-identical partners which 
can synchronize, using for instance private commutative 
filters, it may be difficult for the attacker to synchro- 
nize and to reveal the time dependent output signal of 
the parties [Uj, but one cannot exclude efficient advanced 
software or hardware attacks. A hardware attacker con- 
sists of a similar chaotic setup to those of the synchro- 



nized chaotic partners, whereas a software attacker is able 
to mathematically manipulate the recorded signal. 

In order to exclude any possible software advanced at- 
tack, we map the task of the attacker onto one of the 
NP-Complete (NPC) problems^- The NPC problems 
are the most difficult problems in NP (non-deterministic 
polynomial time) and at present, all known determinis- 
tic algorithms for NPC problems require running time 
that is exponential with some tunable parameters of the 
problem. The main goal of this Letter is to bridge be- 
tween two different disciplines, synchronization in nonlin- 
ear dynamics and the realm of the NPC problems. The 
establishment of such a bridge proves the lack of any pos- 
sible efficient software attack, while the mutually coupled 
chaotic partners are synchronized. Note that the defini- 
tion of the known NPC problems is static 12], and here 
we map a dynamical process onto an NPC problem. 

Hilbert's tenth problem is the tenth on the list of 
Hilbert's problems of 1900[l3j]. Its statement is as fol- 
lows; given a set of Diophantine equations, polynomials 
with integer coefficients, finding an integer solution that 
satisfies the set. The solution of a general set of Diophan- 
tine equations is known to be undecidable 
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However, some subsets of the Diophantine equations are 
known to be decidable and belong to the class of NPC 
problems 14, l^]- A class of Hilbert's tenth problem is to 
find an integer solution of the following set of Diophan- 
tine equations [l6| 



Dy = a(z), 



(1) 



where D is an m x n matrix of rational constants, 
y = (yx, ...,y n ) and a = (ct\(z), ...,cr m (z)) is a column 
vector. The {(Ji(z)} are polynomials with a finite degree 
greater than one. Finding a non negative integer solution 
(yx, ...,y n ,z) to the above set was proven to belong to 
the class of NPC problems (l6j. In this Letter we map the 
task of an attacker in the scenario of two synchronizing 
chaotic units onto this NPC problem. 

We start by denning our synchronization process of two 
interacting units. Consider two iterated chaotic maps x A 
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and x B , which their dynamics are controlled by a general 
self- feedback function Sf and a general coupling function 
S c which are both nonlinear functions of the history r 
steps back 
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S f {x A )+S c {xf) 
S f (x B ) + S c (x?) 



(2) 



where x t = (x t -i, ..,x t - T )- 

Do the two mutually coupled chaotic maps synchro- 
nize under such circumstances? The positive answer is 
demonstrated below for the simplest chaotic maps, the 
Bernoulli mapQ. The dynamics of the two mutually 



coupled units xf 
and is given by 



and xf can be analyzed analytically 



(l-e)f(xt 1 )+e[ K f(xt T ) + (l 
(l-s)f(x B _ 1 )+e[ K f(x B _ T ) + (l 



n)R A (xf)} 
k)R b (x?)} 



(3) 



where f(x) = (ax) mod 1, and a Bernoulli map is 
chaotic for a > 1 [17j ■ The parameter e indicates the 
weight of the delayed terms, n stands for the strength of 
the self-coupling term, and R A ' B (xf' A ) are the received 
signals of each partner. Note that [0, 1] is the allowed 
range for e and k. For the simple case of R A ' B (xf' A ) — 
f A ' B (xf_l T ), a linear expansion of the distance d 
x A —xf leads to d t = (1— e)a<k_i +ea(2K— l)ck— rfl7l.ll 
By assuming that the distance converges/diverges expo- 
nentially in time, dt oc c , we find that the largest condi- 
tional Lyapunov exponent is negative and synchroniza- 
tion is achieved for (a — l)/2ae < K < (2ae + 1 — a)/2ae 
as is depicted in figure QJa). 

In order to map the task of an attacker on this syn- 
chronization process to the presented NPC problem, we 
have to include the following four adjustments to the sys- 
tem: (a) private commutative filters, (b) transmission 
of integer signals, (c) additional nonlinear terms to the 
transmitted signal and (d) periods of cutoffs in communi- 
cation. Our next goal is to explain each one of these ad- 
justments and to show that synchronization is still main- 
tained when applying all of the adjustments simultane- 
ously, and finally to show that the task of the attacker is 
mapped onto the NPC problem, eq. (P). 

The first adjustment is extending the configuration, 
equation ([2]), to the case of non-identical units x A and 



and <7s, and the two transmitted signals are gA(x A ) and 
gsixf), see figure [2] These functions are private, only 
x A knows gA and x B knows gs- The coupling functions 
S c (xf), S c (x A ) are simply the received signals which are 
9A{gB{xf)) and gB{gA{x A )), respectively. In order to 
preserve synchronization as a fix point of the dynamics we 
only use filters that commute, <m(<7b0?)) — gB(gA(x)). 
Since an attacker does not know the filters he cannot use 
them for his hardware attack. 
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FIG. 1: Semi-analytic results for the fraction of the phase 
space, (s, «), where synchronization is achieved for a Bernoulli 
map with r = 100 and a = 1.1. (a) With the absence of filters, 
synchronization is achieved only in the red regime, (b) The 
probability to synchronize in the case of un-clipped filters with 
N = 10 and = 2. 

The most simple commutative filter one can consider 
is convolution. The transmitted signal is defined by 



rr,A,B 

J-t =9A,B 



(x A - B 



jV-1 

= E K %Bf{4± B „) 

u=0 



(4) 



where K v Al K v B G [0,1] are the private keys (filters) cho- 
sen randomly by each one of the partners and v = 
0, 1, . . . , N - 1. We demand that ~£v=o k a.b = h in 
order to ensure that the convolved signal is limited by 
[0,1]. 
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FIG. 2: A setup of two time-delayed mutually coupled units, 
where each unit has a filter influencing both transmitted and 
received signals. 

Before arriving at the other end of the channel, the 
transmitted signal T encounters the second filter. There- 
fore, the received signal for units A and B is 



A,B 



frrB,A\ 
gA,B(T t ) 



N-l 

E 

\x^v— 



K» B K>Xf{xt A -») ■ (5) 



Both units are using different functions (filters) gA Ka,K b oc 



We measure the synchronization time t sync h as a func- 
tion of r and found that in order to achieve linear syn- 
chronization time for N 3> 1, the strengths of the fil- 
ter coefficients, the keys, have to follow a power-law 

- — , where £J« B is a random number be- 



A , ji b ^ 

tween [0,1]. Figure [3lC a) exemplifies the linear scaling 
of t sync h(T) for N — 10 and <f> = 2. The synchro- 
nization phase space was analyzed semi-analytically by 
assuming that the distance between the partners con- 
verges/diverges exponentially with time and then solv- 
ing the characteristic polynomial and the largest eigen- 
value numerically 17J, |l8( . Since the values of the private 
keys Ka,Kb are random, we calculate the probability 
of achieving synchronization in the phase space of (e, n) 
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FIG. 3: Simulation results for the synchronization time, 
tsynch, as a function of r for a — 1.1, TV = 10 and (f> — 2: 
(a) linear filters, and (b) with quantization m = 6, and an 
additional quantized nonlinear term. p t = 2, 3, 4, 5 with equal 
probability, C t G [0,0.1], No = 40 (t mod 40) - 5, N x = 20 
and /V2 = 20, the solid lines were obtained by linear fitting. 

using sampling of random sets of keys. In figure [2] we 
compare the semi-analytic results for the regimes of syn- 
chronization for the basic setup without filters (a) and 
with filters (b). We found that even in this case, the 
regime of synchronization is almost unchanged, 

The next two adjustments ((b) and (c)) to the syn- 
chronization process is modifying the transmitted signal 
to be composed of clipped output keys and signals, and 
also to include a nonlinear term of the past output signal. 
Practically, the precision of the computer is tuq decimal 
digits, and the key-filters and output signals consist of 
only m <C mo most significate decimal digits (or integers 
after multiplying by 10 m ). Adopting these two adjust- 
ments the transmitted signal has the following form: 

AT-l 

T t A ' B = Kl B f(x?l B v ) + C t [f{x A N f)r (6) 

where Ka,b are the clipped keys, and f(x A ± B ) are the 
clipped output signals. Ct[f{x A T ,B )] Pt is the non-linear 
term which is not convolved in the current filters, Ct, 
p t and Nq are public constants used simultaneously by 
both partners. C t 6 [0, 1] and is also clipped, the power 
p t is an integer and N (< t — N) is a time step from the 
past. Since the partners are using different private keys 
(filters), synchronization is a fix point of the dynamics 
only when each partner subtracts his own nonlinear term 
before applying the convolution using his key. Therefore, 
the received signal in case of synchronization is 

R?' B = g AtB (Tt B ' A - C t [f(xif )]*) (7) 

N-l 

= J2 KXf(xf^) 

It is clear that synchronization is a fixed point of the 
dynamical process, since after the convolution at the 
receiver the nonlinear terms appear only in the form 
C t [f (x B o ) Pt — /(a;^ ) Pt ] which vanishes when the part- 
ners are synchronized. It is worthy to note that since the 



keys are normalized and Ct > it is possible that the 
received signal is greater than one, however in practice it 
does not affect the synchronization process, and alterna- 
tively one can apply mod 1 again on the received signal. 
Both methods give the same regime of synchronization. 

For the case of clipped keys and output signals sim- 
ulations with mo = 32 indicate that the regime in the 
phase space where synchronization exists is only slightly 
affected by the quantization of the keys and the trans- 
mitted signals. A typical result for different values of m 
is depicted in figure Q|a). 

The last adjustment ((d)) of our setup is the imple- 
mentation of dynamical filters. For N\ steps the partners 
are using the above mentioned prescription. For the next 
N 2 steps no communication between the partners occurs, 
and each partner is updating his states following his own 
history of continuous signals with k = 1 in eq. ([3]). Af- 
ter each period of silence, iV 2 , each partner is selecting a 
new set of private filters, and in addition, they select the 
nonlinear contribution to the transmitted signal to be a 
function of the signal at a time step, Nq, belonging to 
the previous silence period [l9j|. 

Simulations indicate that while the synchronization 
time and phase space are affected by the nonlinear addi- 
tional term in eq. ((6]) and by the silence periods, t sync h 
still scales linearly with r as depicted in figure [3](b) , 
and synchronization is achieved in a non-negligible frac- 
tion of the phase space. For instance, synchronization 
for p t — 2,3,4,5 with equal probability, C t £ [0,0.1], 
N = 10, Ni = 20, N 2 = 20 and N = 40(i mod 40) - 5 
is depicted in figure Hfb). 




FIG. 4: Simulation results for the fraction of the phase space, 
(e,k), where synchronization is achieved for r = 100, a = 1.1, 
N — 10 and <f> = 2. (a) With quantized linear filters for 
m — 3, 11 (red-unclipped) (b) With quantization m = 6 and 
the same parameters as for Fig. 3(b). 

We now turn to discuss the complexity of a unidirec- 
tional listener. To avoid any software attack or any other 
advanced attacks we now map the task of the attacker to 
the NPC problem, eq. |T]). Assuming a synchronization 
state, x A = xf = x%. In one time step, the transmitted 
signals on both directions, T t ' , consist of 3iV — 2 un- 
known variables: {K^ B }, f(xt), f(xt-N+i)- On the 
next time step, two new equations emerge: T t _£i . These 
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equations consist of previously unknown variables and 
one new unknown variable f{x t +i). Therefore by adding 
more time steps we are adding more equations than new 
variables. Actually the number of required equations to 
decode the keys of length N is 6(N — 1). Therefore, the 
number of required iterations is 3(N — 1). In order for a 
passive attacker to construct the entire signal, he needs 
to eavesdrop over at least 3(iV — 1) successive time steps. 
His task in such a scenario is therefore to solve a set of 
nonlinear Diophantine equations [3, EH- The nonlinear- 
ity emerges since the attacker does not know neither the 
integer keys, K V A B , nor the history of the clipped output 
signals of the partners. 

In order to map our synchronization problem to the 
proven NPC problem, eq. (1) we choose N\ to be in the 
range of N < Ni < 3(JV - 1) (see for instance fig. (Kb)). 
Hence, the task of the attacker is to find the complete 
set of solutions for the nonlinear Diophantine equations 
(unknown clipped keys and history of clipped signals), 
and next to find the correct solution for the observed 
dynamical synchronization process. The number of solu- 
tions is at least one, but can be unbounded, hence, the 
complexity of the attacker is at least NPC, where the 
complexity of the problem increases with N. The silence 
regime, N2 > N was selected to guarantee that the set 
of Diophantine equations the attacker has to solve con- 
sists of nonlinear terms of only one past clipped output 
signal (as formally required by eq. |T])). Note that the 
use of time-dependent filters eliminates, in the jargon of 
nonlinear dynamics, eliminates any approximated recon- 
struction of the trajectory based on Takens embedding 
theorem [20| since the transmitted signal is a discontinu- 
ous function of the chaotic variables. 

Note that also with the lack of adjustment (c) (the 
nonlinear term in eq. ([6|) the problem reduces to the solv- 
ability of linear Diop hantine equations which belongs to 
the class of NPC [la G3, HI]]- However, finding a solution 
of a set of linear Diophantine equations may be feasible 
in practice, in polynomial time using heuristic or proba- 
bilistic methods [221 ]. 

We prove semi-analytically that the security of the 
simplest synchronization process (Bernoulli map) con- 
sists of t time — independent local Lyapunov exponents. 
In simulations we obtained similar results also for more 
structured maps and for the Lang-Kobayashi differential 
equations governing the behavior of semiconductor lasers. 
Note that transmitted signal in lasers is quantized by the 
number of photons and in principle convolutional filters 
can be implemented. 

We thank Johannes, Kesstler, Uri Feige and Aviezri 
Fraenkel for many fruitful discussions. 
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